Warning! Glary Utilites/Iobit infected with Win32.Induc

[Airbot]

Avast and Microsoft's MSE new updates are detecting Win32.Induc virus in Glary Utilites, Iobit and possible other programs compiled with Delphi. They're not false positives.

More info here..

avast! blog » Win32:Induc, new concept of file infector?
Infection Win32:Induc
Glary Utilities Pro v2.15.0.738 infected?
BitDefender Finds Win32.Induc.A Puts Delphi Compilers at Risk and Compromises Legitimate Applications | SYS-CON AUSTRALIA
Win32:Induc, new concept of file infector? - dslreports.com

 

[mansrm81]

Thanks for the heads up Aaron.

 

[zigzag3143]

Aaron

Thanks Again

ken

 

[Tews]

Thanks for the Heads Up Aaron!

 

[Bare Foot Kid]

Thanks Aaron!

 

[AlexT2889]

Hmmm....I had to reinstall IOBit Game Booster 1.21 for the update to work then I got a warning from MSE, thought it was fake since I didn't get it before and I ignored it and let it install completely. Oh well.

 

[johngalt]

I'd perform a scan to find the infected modules. Currently, I know that DVD Flick and this program are using Delphi components so they are vulnerable....

 

[Captain Zero]

I installed this and my cat caught fire!

*ahem*

(Thanks for the head's up, Aaron.)

 

[AlexT2889]

Ahhhh this is much better, I cleared out my MSE detection history and did standalone scan of the IOBit file in My Computer and it redetected the virus and removed it, so far no conflicting problems with the program itself. Thank god

 

[Airbot]

Cats and fire don't mix. You're welcome guys.

 

[gamepro127]

Im pretty sure ESET NOD32 AntiVirus/Smart security v4 detected this virus a LONG time ago. Probably its advanced heuristics.
I remember doing the Online scan with a friend and it removed Glary utilities in the process.

EDIT: Nope NVM it was added in a update 4348:
http://www.eset.eu/podpora/aktualizacia-4348?lng=en

 

[SIW2]

Thanks for the info. Aaron.

Curiously , although Avast was responsible for pointing out these infections on their site - I just scanned my GUPRO (newest version ) with Avast and it comes up clean.

 

[Airbot]

Yeah, Glary has apparently removed the infected files in the version they just released because of this. v2.15.0.728. Sounds as if Glary and Iobit are saying it was misunderstood and picked up as infected and fixed. They're are acting as if it was just a FP, but it most likely isn't. No doubt many other programs compiled with delphi are infected.

 

[SIW2]

Glad you mentioned it.

Scans of GUPRO is clean ( v2.15.0.738 )

A full scan with Avast revealed 3DImageCommander and Icon Commander as being infected. Everything else is clean.

No problem removing them from Vista.

On 7 , there were access denied messages from Avast.

The solution is to rt click on the actual infected file (not the folder) and open it, or scan - you get the Warning from Avast again - this time you can Move to Chest/Delete.

Odd permissions problem on 7.

 

[sabrina]

Yes, Avast detected infected Glary Engcrypter, registry Repair and Splitter with Win32.Induc several days ago. Luckily, now I have downloaded the new version 2.15.0.738 and it's clean.

 

[Mercurial]

yea its been removed only found this on thier site ;P

*just some ad site blocked"?

 

[Bare Foot Kid]

yea its been removed only found this on thier site ;P

Thanks for the update mate.

 

[v0id]

Please don't report virus again,here is the reason.We have fixed the problems.
Glary Utilities has been updated and now it is virus-free.Please download and install it again.

Dear users of Glary Utilities,

We are very sorry for the inconvenient caused by Win32/Induc,but it is not our fault to create the virus.It is the development environment(Delphi) affected by virus that directly lead to the virus in our product.Below is the detailed reason:


Source: http://gladiator-antivirus.com/forum/in ... opic=93000

18 August 2009, 14:21
Virus infects development environment

Anti-virus software vendor Kaspersky has discovered a new type of virus which infects and compromises systems running the Delphi

development environment. After infection, all Delphi programs compiled using the infected Delphi environment are also infected.

Anti-virus laboratory AV-Test has already spotted the first examples in the wild.

The virus affects Delphi versions 4.0, 5.0, 6.0 and 7.0. After making a backup which it names SysConst.bak, it overwrites the

Delphi file SysConst.dcu with a self-compiled version. Since the infected file is loaded whenever Delphi programs are compiled, all

programs generated after this point will be infected.

Updated Virus writers have gone old school with the creation of a virus that infects Delphi files as they are built.

When a Delphi file infected with Induc-A virus is run, it searches for Delphi programming installations on an infected machine and

attempts to infect this installation. More specifically, the malware attempts to infect SysConst.pas, which it then compiles to

SysConst.dcu. Once this process is completed the SysConst.dcu file is programmed to add the Induc-A virus to every new Delphi file

that gets compiled on the system.

A full write-up of the malware, including a screenshot depicting strings of infected code, can be found here.

A full write-up of the malware, including a screenshot depicting strings of infected code, can be found here.

Even the vast majority of computer users that aren't Delphi developers can be affected by running programs written in Delphi that

happen to have been contaminated.

Up until Tuesday afternoon the labs at Sophos have received more than 3,000 infected files, submitted by users who have found

infections. "This makes us believe that the malware has been active for some time, and that a number of software houses

specialising in developing applications with Delphi must have been infected," writes Graham Cluley, senior technology consultant at

Sophos.

Examples of infections have included applications described as "a tool for downloading configuration files onto GSM modules" and "a

compiler interface that operates between our third-party design software and our CNC woodworking machinery".

Delphi is used to quickly develop Windows applications. Some of the infected files are banking Trojans written in Delphi - so some

hackers are among those hit by the virus.

This is what they said on forum!